Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-91147

Publication date:

18/09/2026

A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2026

CVE-2026-91149

Publication date:

18/09/2026

A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2026

CVE-2026-85478

Publication date:

18/09/2026

A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that permits inspection or modification of boot configuration, firmware data, and software loaded by the device.

Severity CVSS v4.0: LOW

Last modification:

21/09/2026

CVE-2026-85497

Publication date:

18/09/2026

CareCam CM2507 IP cameras store the device&#39;s root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable across other devices running the same firmware.

Severity CVSS v4.0: CRITICAL

Last modification:

21/09/2026

CVE-2026-81505

Publication date:

18/09/2026

Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy&#39;s GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID() and fetches the Source only by sourceID without confirming that its ProjectID matches the authorized project. An authenticated user or project-scoped API key holder can substitute another tenant&#39;s Source identifier and receive that Source&#39;s complete record, including unredacted AMQP, Kafka, SQS, or Google PubSub credentials. The list endpoint remains project-scoped; the single-item Source lookup is affected. This issue is fixed in version 26.6.8.

Severity CVSS v4.0: HIGH

Last modification:

24/09/2026

CVE-2026-77608

Publication date:

18/09/2026

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki&#39;s pages. Prior to version 7.2.0, when the `value` parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0 fixes the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

24/09/2026

CVE-2026-77609

Publication date:

18/09/2026

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki&#39;s pages. Prior to version 7.2.0, `Special:URIResolver` resolves its user-controlled subpage to a MediaWiki title and issues an HTTP 303 redirect to `$title->getFullURL()` without validating the resolved target. A crafted subpage can make that target point off-host: an interwiki prefix redirects to the foreign wiki (for example `Special:URIResolver/mw-3AFoo`, which decodes to `mw:Foo`, redirects to `https://www.mediawiki.org/wiki/Foo`), and where the resolved URL carries an authority the target can even embed `user:pass@host` credentials. The result is an open redirect to an attacker-influenced host, usable for phishing from a trusted wiki URL. Version 7.2.0 fixes the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

24/09/2026

CVE-2026-77610

Publication date:

18/09/2026

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki&#39;s pages. Prior to version 7.2.0, query debug output (`format=debug`, or the `debug` request parameter on `Special:Ask`) is assembled by `SMW\Query\DebugFormatter` and emitted as raw HTML. Several of its sinks apply no output-context encoding, so attacker-controlled query input is reflected into the page without escaping. On `Special:Ask` the resulting string is concatenated into the page and sent through `OutputPage::addHTML`, never through the MediaWiki parser or Sanitizer. No special user right is required; an anonymous request suffices. This is a reflected XSS: the payload is taken from the request and echoed in the same response. Exploitation requires the query condition to target a text/blob-typed property (whose value is re-serialized verbatim); the predefined `_txt` properties (`Text`, etc.) that ship on every install satisfy this, so no attacker-created content is needed. Version 7.2.0 patches the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

24/09/2026

CVE-2026-77616

Publication date:

18/09/2026

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki&#39;s pages. In versions 7.0.0 through 7.1.0, `Special:Ask` accepts a `cursor` query parameter for keyset pagination (added in 7.0.0). The token is decoded by `CursorEncoder`, which is an **unsigned** base64url-encoded JSON blob, so its contents are fully attacker-controlled. When the cursor&#39;s sort anchor does not match the request&#39;s `sort=` / `order=`, `QueryCreator::applyCursorIfRequested()` builds an error message by interpolating the attacker-controlled `sort_prop` / `sort_order` values into a raw string via `Query::addErrors()`. Unlike SMW&#39;s message-key errors, this raw string bypasses the message layer&#39;s sanitization (`ProcessingErrorMsgHandler::normalizeAndDecodeMessages()` passes a non-key, non-encoded string through unchanged). `ErrorWidget::queryError()` then assembles the errors and passes them to `Html::errorBox()`, whose first argument is emitted as raw HTML. The result is a reflected cross-site scripting vulnerability: a crafted `cursor` token containing markup in `sort_prop` (or `sort_order`) executes script in the victim&#39;s browser on the wiki origin. No authentication or special permission is required. The payload is delivered via a crafted link. Version 7.2.0 contains a fix.

Severity CVSS v4.0: Pending analysis

Last modification:

24/09/2026

CVE-2026-77301

Publication date:

18/09/2026

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry&#39;s central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing Buffer.alloc and decompression handling to commit excessive resident memory before CRC validation reports an error. Applications that read entries from untrusted archives can therefore be terminated by the operating system or suffer service-wide memory exhaustion. This issue is fixed in version 0.6.1.

Severity CVSS v4.0: Pending analysis

Last modification:

24/09/2026

CVE-2026-73863

Publication date:

18/09/2026

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ&#39;s broker-side MQTT v5 nmq_subinfo_decode() function in nng/src/sp/protocol/mqtt/mqtt_parser.c reuses len_of_varint from the outer Properties Length while parsing each SUBSCRIPTION_IDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte Properties Length and repeated subscription identifiers, causing get_var_integer() to begin at an incorrect offset and read beyond the heap message buffer. The flaw is reachable through the broker receive path and can crash the broker, while the separately reported topic-option off-by-one occurs later and is not this vulnerability. This issue is fixed in version 0.24.14.

Severity CVSS v4.0: HIGH

Last modification:

24/09/2026

CVE-2026-77606

Publication date:

18/09/2026

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki&#39;s pages. Prior to version 7.2.0, when `headers=plain`, table header text was emitted into `` via a raw HTML path. User-controlled `mainlabel` content could therefore become executable HTML. Version 7.2.0 fixes the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

24/09/2026

Subscribe to Vulnerabilities